Re: [PATCH] lib: decompress_unxz: fix memory leak of 'in' buffer in single-call mode

[Lasse Collin]

On 2026-08-25 Ivy Lopez wrote:
> When fill and flush are both NULL (single-call mode), unxz() takes
> the xz_dec_run() fast path and skips straight to xz_dec_end(s),
> bypassing the free(in)/free(b.out) cleanup that only runs inside the
> multi-call (fill/flush) branch. If 'in' was NULL on entry, it gets
> allocated locally (must_free_in = true) and is never freed on this
> path, leaking XZ_IOBUF_SIZE bytes on every single-call decompression
> that doesn't supply its own input buffer.

There's no leak because calling with fill == NULL && flush == NULL &&
in == NULL is invalid. See this thread:

https://lore.kernel.org/lkml/20241006072542.66442-2-t.v.s10123@xxxxxxxxx/T/

Maybe the code needs to be changed to prevent repeated attempts to "fix"
it. I will get back to this in 1-3 days.

-- 
Lasse Collin